300-410 Practice Exam 65 — 20 Questions

Question 1

A network engineer runs the following command on Router R1:

R1# show ipv6 eigrp neighbors

IPv6-EIGRP neighbors for process 100
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
0   FE80::A8BB:CCFF:FE00:2  Tunnel0          13 00:23:45   10   200  0  12
1   FE80::A8BB:CCFF:FE00:3  Tunnel1          12 00:22:10   15   200  0  15

Based on this output, which statement is correct?

Accepted Answer

EIGRP for IPv6 adjacencies are established over the tunnels.. The output shows two IPv6 EIGRP neighbors with link-local addresses (FE80::/10) on interfaces Tunnel0 and Tunnel1, and the adjacency is established and exchanging routes (Seq Num increasing). This confirms that EIGRP for IPv6 adjacencies are formed over these tunnel interfaces, making option C correct.

Answer

EIGRP is not configured for IPv6.

Answer

The neighbors are using global unicast addresses.

Answer

The tunnels are using GRE encapsulation.

Question 2

A network engineer runs the following command on Router R1:

R1# show ip sla statistics
IPSLAs Latest Operation Statistics

IPSLA operation id: 1
        Type of operation: icmp-echo
        Latest RTT: 20 milliseconds
        Latest operation start time: 12:00:00 UTC Mon Mar 1 2021
        Latest operation return code: OK
        Number of successes: 100
        Number of failures: 0

Based on this output, which statement is correct?

Accepted Answer

The IP SLA probe is successfully reaching the target with no failures.. The output shows 100 successes and 0 failures for the ICMP echo operation, with a latest return code of OK, confirming that the IP SLA probe is successfully reaching the target without any failures. The 'Number of successes: 100' and 'Number of failures: 0' directly indicate a 100% success rate for the probe.

Answer

The IP SLA probe has failed 100 times.

Answer

The IP SLA probe is using UDP jitter.

Answer

The IP SLA probe is not configured because the operation ID is 1.

Question 3

A network engineer runs the following command on Router R1:

R1# show ipv6 traffic | include tunnel

0 tunnel packets received
  0 tunnel packets sent
  0 tunnel packets dropped

Based on this output, what can be concluded?

Accepted Answer

The tunnel is not carrying any IPv6 traffic.. The 'show ipv6 traffic | include tunnel' command filters the output to show only lines containing 'tunnel'. The counters for packets received, sent, and dropped are all zero, which indicates that no IPv6 packets have been encapsulated or decapsulated by any tunnel interface. This means the tunnel is not carrying any IPv6 traffic, making option B correct.

Answer

The tunnel is passing traffic normally.

Answer

The tunnel is dropping all packets.

Answer

The tunnel is using IPsec encryption.

Question 4

A network engineer runs the following command on Router R1:

R1# show mpls ldp neighbor
    Peer LDP Ident: 192.168.2.2:0, Local LDP Ident: 192.168.1.1:0
        TCP connection: 10.1.1.2.646 - 10.1.1.1.646
        State: Oper; Msgs sent/rcvd: 100/100; Downstream
        Up time: 00:45:00
        LDP discovery sources:
          GigabitEthernet0/0, Src IP addr: 10.1.1.2
        Addresses bound to peer LDP Ident:
          10.1.1.2     192.168.2.2

Based on this output, what is the state of the LDP session?

Accepted Answer

The LDP session is operational and exchanging label information.. The output shows 'State: Oper', which indicates the LDP session is operational. The 'Downstream' label distribution mode and the fact that messages have been sent and received (100/100) confirm that the session is actively exchanging label information. This matches the correct answer that the LDP session is operational and exchanging label information.

Answer

The LDP session is in a down state due to a TCP reset.

Answer

The LDP session is in initialization state because no labels have been exchanged.

Answer

The LDP session is using UDP instead of TCP.

Question 5

A network engineer runs the following command on Router R1:

R1# show ip eigrp neighbors
EIGRP-IPv4 Neighbors for AS(100)
H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq
                                                   (sec)         (ms)       Cnt Num
0   10.1.1.2                Gi0/0                  13   00:12:34  1      200  0  45
1   10.2.2.2                Gi0/1                  12   00:11:20  2      200  0  67
2   10.3.3.2                Gi0/2                  10   00:10:15  1      200  0  89

Based on this output, which statement is correct?

Accepted Answer

All EIGRP neighbors are fully operational with no issues.. The output shows all three EIGRP neighbors with hold timers above 0, low SRTT values (1-2 ms), RTO at 200 ms, and a Q count of 0, indicating no queued packets. These metrics confirm that the neighbors are fully operational and stable, with no packet loss, congestion, or routing issues.

Answer

The neighbor on Gi0/2 is experiencing packet loss because its hold timer is 10 seconds.

Answer

The neighbor on Gi0/0 has a high SRTT, indicating congestion.

Answer

The neighbor on Gi0/1 has a sequence number of 67, which is higher than others, indicating a routing loop.

Question 6

Which TWO commands would a network engineer use to verify OSPFv2 neighbor state and adjacency issues on a Cisco IOS router? (Choose TWO.)

Accepted Answer

show ip ospf neighbor. Option A, 'show ip ospf neighbor', is correct because it directly displays each OSPFv2 neighbor's router ID, state (e.g., FULL, 2-WAY, EXSTART, INIT), and dead timer, which is the primary way to verify neighbor state and spot adjacency problems. Option B, 'debug ip ospf adj', is correct because it logs real-time adjacency events such as Hello receipt, DR/BDR election, and state transitions, making it the go-to tool for diagnosing why an adjacency is stuck or flapping. Option C, 'show ip route ospf', only shows OSPF-learned routes in the routing table and does not reveal neighbor state or adjacency negotiation. Option D, 'show ip ospf interface', shows interface-level OSPF parameters (area, timers, network type, DR/BDR) but not the neighbor state table itself. Option E, 'show ip protocols', summarizes routing protocol configuration and timers but does not provide per-neighbor adjacency detail.

Answer

show ip route ospf

Answer

show ip ospf interface

Answer

show ip protocols

Question 7

Consider the following partial configuration on a Cisco IOS-XE switch:

monitor session 1 source interface GigabitEthernet1/0/1 both
monitor session 1 destination interface GigabitEthernet1/0/2

What is the effect of this configuration?

Accepted Answer

It copies all traffic received and transmitted on GigabitEthernet1/0/1 to GigabitEthernet1/0/2.. The 'both' keyword in the source interface command instructs the switch to mirror traffic in both directions — ingress (received) and egress (transmitted) — from the source port. The destination interface command directs that mirrored copy to GigabitEthernet1/0/2, so all traffic in and out of Gi1/0/1 is duplicated to Gi1/0/2. This is the standard SPAN (Switched Port Analyzer) configuration used for packet capture and IDS monitoring.

Answer

It copies only ingress traffic from GigabitEthernet1/0/1 to GigabitEthernet1/0/2.

Answer

It copies only egress traffic from GigabitEthernet1/0/1 to GigabitEthernet1/0/2.

Answer

It copies traffic from GigabitEthernet1/0/2 to GigabitEthernet1/0/1.

Question 8

Which TWO statements about RSPAN are true? (Choose TWO.)

Accepted Answer

RSPAN uses a dedicated VLAN to carry monitored traffic between switches.. Option A is correct because RSPAN (Remote Switched Port Analyzer) works by defining a special RSPAN VLAN that carries the mirrored traffic across the network from the source switch to the destination switch, unlike local SPAN which stays within one device. Option B is correct because that RSPAN VLAN must be permitted on every trunk link along the path between the source and destination switches, otherwise the monitored frames cannot traverse the interswitch links and reach the destination port. Option C is incorrect because RSPAN does not use GRE encapsulation; GRE-based mirroring is associated with ERSPAN, which transports mirrored traffic over Layer 3 networks. Option D is incorrect because RSPAN does not require a dedicated monitoring server at the source switch; the source switch simply copies traffic into the RSPAN VLAN, and analysis is typically done at the destination switch. Option E is incorrect because RSPAN is specifically designed to extend SPAN across multiple switches, not to be limited to a single switch.

Answer

RSPAN encapsulates traffic in GRE headers for transport across Layer 3 networks.

Answer

RSPAN requires a dedicated monitoring server at the source switch.

Answer

RSPAN can only be configured on a single switch.

Question 9

Consider the following configuration on a PE router:

ip vrf CUSTOMER-B
 rd 100:1
 route-target export 100:1
 route-target import 100:2
!
interface GigabitEthernet0/2
 ip vrf forwarding CUSTOMER-B
 ip address 192.168.2.1 255.255.255.252

What is the effect of this configuration?

Accepted Answer

The PE will export routes from VRF CUSTOMER-B with RT 100:1 and import routes with RT 100:2.. The VRF has a route distinguisher and route-targets. The export RT is 100:1, meaning routes from this VRF are exported with that RT. The import RT is 100:2, so only routes with RT 100:2 are imported. This is a common setup for hub-and-spoke or inter-AS options.

Answer

The PE will export routes with RT 100:2 and import routes with RT 100:1.

Answer

The VRF will not work because the RD and RT must be identical.

Answer

The VRF will not work because route-target import and export must be configured under the BGP VRF address-family.

Question 10

A network engineer runs the following command to troubleshoot a Route Redistribution issue:

R1# debug ip ospf adj

And sees the following output:

*Mar  1 00:20:11.456: OSPF: Rcv pkt from 10.1.1.2, Serial0/0/0 : Mismatch Authentication type. Input packet specified type 0, we use type 1
*Mar  1 00:20:11.457: OSPF: Rcv pkt from 10.1.1.2, Serial0/0/0 : Mismatch Authentication type. Input packet specified type 0, we use type 1

What does this output indicate?

Accepted Answer

OSPF authentication is misconfigured; the neighbor is not using authentication while this router is.. The debug output shows 'Mismatch Authentication type. Input packet specified type 0, we use type 1'. In OSPF, authentication type 0 means no authentication, while type 1 is plaintext password authentication. This indicates that the local router is configured for plaintext authentication, but the neighbor is not using authentication, causing a mismatch and preventing adjacency formation.

Answer

OSPF adjacency is forming successfully with authentication.

Answer

OSPF is redistributing routes correctly but authentication is failing.

Answer

The OSPF process is using MD5 authentication and the neighbor is using plaintext.

Question 11

A network engineer is troubleshooting an issue where IPv6 hosts are receiving multiple Router Advertisements from different routers, causing routing instability. The switch is configured with IPv6 First Hop Security features. The engineer wants to ensure that only the primary router's RAs are accepted by hosts. What is the most effective solution?

Accepted Answer

Configure RA Guard with a policy that includes the primary router's MAC address in the allowed list and apply it to all ports.. RA Guard with a policy that includes the primary router's MAC address in the allowed list is the most effective solution because it filters Router Advertisements (RAs) at Layer 2, permitting only RAs from the trusted primary router. This directly addresses the issue of multiple RAs causing routing instability by blocking RAs from any other source, such as the secondary router, without affecting other IPv6 traffic. RA Guard is an IPv6 First Hop Security feature designed specifically to prevent rogue or unwanted RAs from being processed by hosts.

Answer

Enable DHCPv6 Guard to block DHCPv6 messages from the secondary router.

Answer

Use IPv6 Source Guard to filter traffic from the secondary router.

Answer

Configure the switch to act as a router and send its own RAs with a higher priority to override the secondary router.

Question 12

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue:

R1# show crypto isakmp sa detail

IPv4 Crypto ISAKMP SA
C-id  Local        Remote       I-VRF    Status Encr Hash Auth DH Lifetime Cap.
1001  192.168.1.1  192.168.2.2           ACTIVE des  sha  pre 2   23:59:21
1002  192.168.1.1  192.168.2.2           ACTIVE 3des sha  pre 2   23:58:15

IPv6 Crypto ISAKMP SA

What does this output indicate?

Accepted Answer

There are two active ISAKMP SAs between the peers, which suggests a configuration error such as multiple ISAKMP policies or aggressive mode issues.. The output shows two active ISAKMP SAs between the same peers (192.168.1.1 and 192.168.2.2) with different encryption algorithms (DES and 3DES). Under normal operation, only one ISAKMP SA should exist per peer pair. Having multiple SAs indicates a configuration error, such as multiple ISAKMP policies that both match, or aggressive mode causing duplicate SAs. This is not a sign of redundancy; ISAKMP SAs are not redundant by design.

Answer

The IPsec VPN is functioning correctly with two redundant ISAKMP SAs.

Answer

The ISAKMP SA is using DES encryption, which is weak and should be upgraded.

Answer

The ISAKMP SA lifetime is about 24 hours, which is the default.

Question 13

A network engineer runs the following command to troubleshoot an EEM issue:

R1# show event manager policy registered

No.  Class        Type    Version   Time Created          Name
  1  applet       system  1.0       Mar 1 00:00:12 2025  TRACK-INTERFACE
  2  applet       system  1.0       Mar 1 00:00:15 2025  BGP-RESET
  3  applet       user    1.0       Mar 1 00:02:30 2025  LOG-ERROR

What does this output indicate?

Accepted Answer

Three EEM applets are registered, including two system-defined and one user-defined.. The 'show event manager policy registered' output lists three EEM applets: TRACK-INTERFACE and BGP-RESET are of class 'applet' and type 'system', meaning they are system-defined (built-in) applets, while LOG-ERROR is of type 'user', meaning it was created by an administrator. Therefore, the output indicates two system-defined and one user-defined applet.

Answer

Three EEM applets are registered, all user-defined.

Answer

Three EEM applets are registered, all system-defined.

Answer

The output shows the EEM applets that are currently executing.

Question 14

Which TWO commands would a network engineer use to verify the results of route redistribution from OSPF into EIGRP? (Choose TWO.)

Accepted Answer

show ip route eigrp. Option A, 'show ip route eigrp', is correct because it displays the EIGRP-learned routes in the routing table, so the engineer can confirm that redistributed OSPF routes actually appear as EIGRP routes (marked with D or D EX) and were installed. Option D, 'show ip eigrp topology', is correct because it shows the EIGRP topology table, including all routes EIGRP has received via redistribution, their feasible distance, reported distance, and successor/feasible successor status, verifying that the redistributed prefixes were accepted into EIGRP. Option B, 'show ip ospf database', only displays OSPF link-state advertisements and does not show whether those routes were redistributed into EIGRP. Option C, 'show ip protocols', shows redistribution configuration parameters but not the actual redistributed route entries, so it is not the best verification of results. Option E, 'show ip eigrp traffic', only displays EIGRP packet counters and statistics, not route redistribution results.

Answer

show ip ospf database

Answer

show ip protocols

Answer

show ip eigrp traffic

Question 15

A network engineer runs the following command to troubleshoot a Policy-Based Routing (PBR) issue:

R1# show ip policy
Interface   Route-map
FastEthernet0/0  PBR-MAP

What does this output indicate?

Accepted Answer

PBR is enabled on FastEthernet0/0 with route-map PBR-MAP.. The output shows that PBR is applied on FastEthernet0/0 using route-map PBR-MAP. This confirms the interface-level configuration.

Answer

The route-map PBR-MAP is not configured.

Answer

PBR is applied globally and on the interface.

Answer

The route-map is applied to all interfaces.

Question 16

A network engineer runs the following command to verify MPLS LDP route filtering:

R1# show mpls ldp bindings 192.168.10.0 255.255.255.0
  lib entry: 192.168.10.0/24, rev 6
    local binding:  label: 21
    remote binding: lsr: 2.2.2.2:0, label: 22
    remote binding: lsr: 3.3.3.3:0, label: 23

What does this output indicate?

Accepted Answer

The prefix 192.168.10.0/24 has a local label of 21 and remote labels from two neighbors.. The output shows a local binding with label 21 for 192.168.10.0/24 and two remote bindings from LSRs 2.2.2.2:0 (label 22) and 3.3.3.3:0 (label 23). This confirms the prefix has a local label assigned and remote labels learned from two LDP neighbors, indicating active LDP sessions with both peers.

Answer

The prefix 192.168.10.0/24 is being filtered by a route-map.

Answer

The LDP session with 2.2.2.2 is down.

Answer

The prefix 192.168.10.0/24 is not in the routing table.

Question 17

A network engineer runs the following command to troubleshoot a Device Access Control issue:

R1# show mpls ldp bindings 10.10.10.0 24

lib entry: 10.10.10.0/24, rev 2
        local binding:  label: 101
        remote binding: lsr: 10.1.1.2:0, label: 102
        remote binding: lsr: 10.1.2.2:0, label: 103

What does this output indicate?

Accepted Answer

The router has a local label of 101 for the prefix and has learned two remote labels from two different neighbors.. The output of 'show mpls ldp bindings 10.10.10.0 24' displays the Label Information Base (LIB) entry for prefix 10.10.10.0/24. The 'local binding: label: 101' indicates that this router has assigned label 101 to the prefix. The two 'remote binding' lines show that two different LDP neighbors (LSR IDs 10.1.1.2 and 10.1.2.2) have advertised labels 102 and 103 respectively for the same prefix. This is the normal operation of LDP, where a router learns multiple remote labels for the same FEC from different peers.

Answer

The router has only a local label of 101; the remote bindings are not used because they are from the same LSR.

Answer

The label 102 is the local label for the prefix 10.10.10.0/24.

Answer

The router has no label for the prefix because the lib entry is incomplete.

Question 18

A network engineer is troubleshooting MPLS traffic where packets are being forwarded without a label (IP forwarding) instead of being label-switched. The engineer runs show mpls forwarding-table and sees that the FEC for the destination prefix has a valid label. However, show ip cef shows that the outgoing interface is not MPLS-enabled. What is the most likely cause?

Accepted Answer

The outgoing interface is missing the mpls ip command.. For MPLS label switching to occur on an interface, the interface must have MPLS enabled with the 'mpls ip' command (or 'mpls ldp' depending on platform). If 'show ip cef' shows the outgoing interface is not MPLS-enabled, the router falls back to IP forwarding even though a label exists in the LFIB. Enabling MPLS on the interface restores label imposition and forwarding.

Answer

The CEF is disabled globally.

Answer

The mpls label protocol ldp command is missing on the interface.

Answer

The interface is a loopback interface.

Question 19

A network engineer runs the following command on Router R1:

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
192.168.1.2     1     FULL/DR        00:00:35    10.1.1.2        GigabitEthernet0/0
192.168.2.2     1     2WAY/DROTHER   00:00:32    10.2.2.2        GigabitEthernet0/1
192.168.3.2     1     FULL/BDR       00:00:38    10.3.3.2        GigabitEthernet0/2

Based on this output, what is a potential issue?

Accepted Answer

All neighbors are in FULL state, indicating no issues.. The output shows normal OSPF neighbor states on a broadcast multi-access network. The neighbor on Gi0/1 is in the 2WAY/DROTHER state, which is expected for non-DR/BDR routers. The neighbors on Gi0/0 and Gi0/2 are in FULL state (DR and BDR respectively). All states are valid, so there is no issue.

Answer

The neighbor on Gi0/1 is not forming a full adjacency because it is in 2WAY state.

Answer

The neighbor on Gi0/0 is the DR, which is causing high CPU usage.

Answer

The neighbor on Gi0/2 is the BDR, which is a problem because it should be the DR.

Question 20

A network engineer runs the following command on Router R1:

R1# show ip policy
Interface     Route-map
GigabitEthernet0/0      PBR-VOICE

R1# show route-map PBR-VOICE
route-map PBR-VOICE, permit, sequence 10
  Match clauses:
    ip address (access-lists): 130
  Set clauses:
    ip next-hop 192.168.10.1
  Policy routing matches: 0 packets, 0 bytes

R1# show access-lists 130
Extended IP access list 130
    10 permit udp any any range 16384 32767

R1# show interfaces GigabitEthernet0/0
GigabitEthernet0/0 is up, line protocol is up
  Internet address is 10.1.1.1/24

R1# show ip route 192.168.10.1
% Network not in routing table

Based on this output, what is the most likely problem?

Accepted Answer

The next-hop 192.168.10.1 is not reachable.. The route map PBR-VOICE sets the next-hop to 192.168.10.1, but 'show ip route 192.168.10.1' returns '% Network not in routing table,' meaning the router has no route to that next-hop address. PBR requires the next-hop to be reachable via the routing table (or be a directly connected interface); otherwise, the policy route cannot be installed and matched packets are dropped or fall through. This is the most likely problem, matching option B.

Answer

The access list 130 is not matching any traffic.

Answer

The interface GigabitEthernet0/0 is down.

Answer

The route map is missing a permit statement.